gootkit | 0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b

General

Target

0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
Size

189KB
MD5

84a6b69a72f274cde26972ae3ef0ff13
SHA1

bc30f84067ed408b34892e23a1916512010d7ee2
SHA256

0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b
SHA512

b501438d74a2e744552165a5a0345993bd74512d659d86bf37f9d0d351e2a116d02bf85995126e89e48c468d5fc8e3c2c13f7f89bed62a42034764b7ed4b1a93
SSDEEP

3072:7gHJtiqAdeqgQS7RFAhADrXlJLzPb8R7Hi+xv+eSdu+g58QYwW/lioQ:7o6dgQeRlHXlJLzPK7P6Z+8QYn/l

Score

10^/10

gootkit 2862 banker botnet trojan

Malware Config

Extracted

Family

gootkit

Botnet

2862

C2

roma.simplebutmatters.com

dom.jmitchelldayton.com

Attributes

vendor_id
2862

Signatures

Gootkit
Gootkit is a banking trojan, where large parts are written in node.JS.
trojan banker botnet gootkit

Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs

Modify Registry

T1112

Processes:

0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe

pid	process
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe

description	pid	process	target process
PID 972 wrote to memory of 1396	972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
PID 972 wrote to memory of 1396	972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
PID 972 wrote to memory of 1396	972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
PID 972 wrote to memory of 1396	972	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe	0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe

C:\Users\Admin\AppData\Local\Temp\0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
"C:\Users\Admin\AppData\Local\Temp\0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe"
1⤵
- Modifies Internet Explorer Protected Mode
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:972
- C:\Users\Admin\AppData\Local\Temp\0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe
  C:\Users\Admin\AppData\Local\Temp\0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b.exe --vwxyz
  2⤵
  PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/972-55-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/972-56-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1396-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads